CVE-2026-50136

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values. This vulnerability is fixed in 3.39.3.

• CWE-306

• https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfhExploit, Vendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfhExploit, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50130Pi-hole is a DNS sinkhole that protects devices from unwante…8.8
• CVE-2026-50131Fedify is a TypeScript library for building federated server…8.6
• CVE-2026-50132Budibase is an open-source low-code platform. Prior to 3.39.…7.3
• CVE-2026-50133Hugo is a static site generator. Prior to 0.162.0, Hugo acce…6.1
• CVE-2026-50134Hugo is a static site generator. From 0.91.0 until 0.162.0, …5.8
• CVE-2026-50135Hugo is a static site generator. From 0.123.0 to 0.161.1, a …5.5
• CVE-2026-50137Budibase is an open-source low-code platform. Prior to 3.39.…9.4
• CVE-2026-5014A vulnerability was found in elecV2 elecV2P up to 3.8.3. The…5.5
• CVE-2026-50141Woodpecker is a CI/CD engine. Starting in version 3.0.0 and …7.1
• CVE-2026-50144ncnn is a high-performance neural network inference framewor…7.1
• CVE-2026-50146Astro is a web framework. Prior to 6.3.3, when a component u…6.1
• CVE-2026-50147Metabase is an open-source business intelligence and embedde…7.6